Hi ede_pfau,
I' m not sure about:
Please read into the Admin Guide again about the file system choices. In my understanding the ' internal indexed file system' is identical to the ' Local database' . Only recently Fortinet introduced the option to store the data in a SQL database (both internally and externally). This allows a lot more detail in analyzing but it doesn' t run with the ' old' reports - you' ll have to build your reports from scratch. (So I reverted back to the Local DB after trying it out.)Because, as the Admin guide said (Rev. 5 & 13):
Configuring SQL database storage The FortiAnalyzer unit saves logs received to the default proprietary indexed file storage system which is always ready to accept log data, it can also insert the log data into the Structured Query Language (SQL) database for generating reports. Both local and remote SQL database options are supported.I' m uploaded the pic of the SQL configuration of my FAZ 1000B. I' m asking back this question because of as my previous question (LDAP):
Now, my new question. I can configure the LDAP configuration. I can query the LDAP Distinguished Name Query based on Anonymous or Regular server type. Our company uses LDAP server (Domain server). Each user must login to domain server if they want to use their PC. Our domain server running under Windows 2008 server. My main goal is, by configuring the LDAP I can view the ' User' column in Log & Archive based on LDAP server. But it' s not. What for the ' User' column BTW?After I read into the Admin Guide again:
LDAP queries are used in FortiAnalyzer reports as an additional filter for the user field, providing a convenient way for filtering log data without having to list the user names manually. For example, you need to create a scope in a report that is restricted to include only log messages whose user= field matches user names retrieved from the network’s main LDAP server. For more information about LDAP queries in FortiAnalyzer reports, see “Configuring reports from logs in the proprietary indexed file system†on page 145.
Configuring reports from logs in the proprietary indexed file system If you have disabled SQL database for log storage in System > Config > SQL Database, you must instead configure reports based on logs from the proprietary indexed file system.I' m sorry for asking you about this question again.
Hi ede_pfau,
right now, my FAZ received a new error (I attached you the pic). what does of this error means?
Oh yes, if you have any link/reference about the errors of FAZ, please let me know.
Regards,
Ruli
Hi ede_pfau,
now, my FAZ received a new error again :
" Disk has rolled the max number of times. It will not roll logs again until deleting some of the old rolled logs" .
It looks like a serious error and I don' t know how to handle it. How to delete some of the old rolled logs? Please help me.
The error started since the date June 19, 2011 until now and the error still occurs. I attched you the pic.
FYI, our FAZ' s Log File Options is set to Optional:
-Log file should not exceed 100 MB
-Log file should be rolled Optional even if size is not exceeded
Oh yes, why this error occurs? How to prevents it? With this error, are all the reports still continue?
The last thing I did are I created many Past Week reports and put them on the dashboard and also I put many Last 24 Hours report and put them on the dashbord too. Maybe by doing created many reports and put them on dashboard causing this error?
I' m also often (not very often) trying CLI' s command:
-Remove and rebuild the widget reports on the dashboard:
diag sys dashboard rebuild-reports
-Use this command to send logs received by the FortiAnalyzer unit
to the SQL database for generatingreports:
execute reset-sqllog-transfer
Hi,
I have another question regarding of error/warning message from Event log' s LocalLogs (Log & Archive - Event - LocalLogs) FAZ 1000-B:
raid1: raid set md0 active with 1 out of 1 mirrors
What does it means?
